feat(auth): add SURFconext OIDC connector when we move to SURF infrastructure

[simonvanlierde]

Relab already supports Google and GitHub OAuth login. Once we move onto SURF infrastructure, add SURFconext as a third provider so Leiden/CML researchers can sign in with their institutional account.

To do's

The backend is already provider-generic: LOGIN_PROVIDERS in backend/app/api/auth/services/oauth/routes.py builds every login and associate route from a tuple, and httpx-oauth (already a dependency) ships a discovery based OpenID client.

• Add a _RelabSurfconextOAuth2(OpenID) client in
  backend/app/api/auth/services/oauth/clients.py, pointed at
  https://connect.surfconext.nl/.well-known/openid-configuration. Override get_httpx_client
  for the shared SSRF-hardened client, and override get_id_email to only return the address
  when email_verified is set — same guard the Google and GitHub clients have.
• Add surfconext_oauth_client_id / surfconext_oauth_client_secret to AuthSettings and the
  env map in backend/app/api/auth/config.py.
• Add one OAuthProviderRoutes entry to LOGIN_PROVIDERS. Decide associate_by_email: Google
  is True, GitHub is False. SURFconext asserts institutional email, so True is probably
  right, but it does mean a SURF login merges into an existing password account with that
  address.
• App: widen the hardcoded 'google' | 'github' union (src/features/auth/useOAuthLogin.ts,
  src/features/profile/useOAuthAssociations.ts, src/components/profile/AccountSections.tsx),
  add the login button and account link/unlink row, and add connect.surfconext.nl to
  ALLOWED_OAUTH_HOSTNAMES in src/services/api/oauthFlow.ts.
• Add a SURF brand icon to assets/icons/brand/ and sync it.
• Ops: two entries each in compose.deploy.yaml, .env.example, and scripts/env_policy.py;
  two files in secrets/<env>/.
• Docs: operations/install.md and architecture/auth.mdx.
• Tests: extend the existing fixtures in backend/tests/integration/api/auth/_oauth_support.py.